CVSS attack vectors classify how an attacker reaches a target. Network means remote access, adjacent requires local network proximity, local needs user login, and physical demands hardware access. This distance metric heavily influences the final severity score.
The Post Office Analogy
Imagine your application is a secure post office. The CVSS attack vector metric measures how close a thief must stand to steal a parcel. If the thief can send a letter from another country, the risk is high because the barrier to entry is low. If the thief must walk into the building, the risk drops. If they must already have an employee badge, it drops further. If they must physically break the lock on the back door, the remote risk is minimal, though the consequence of success is total.
This analogy helps you visualise why distance matters. It is not just about technical complexity. It is about the effort required to reach the target. The less effort required, the higher the score.
Defining the Four Distances
CVSS defines four specific distances. Each one represents a different level of access an attacker must achieve before they can attempt an exploit. You will see these terms in every vulnerability report. Understanding the nuance between them prevents you from misjudging the urgency of a patch.
Network means the vulnerable component is bound to the network stack. The attacker can be anywhere on the internet. There are no trust relationships or special network configurations required. This is the most common vector for web applications.
Adjacent means the attacker must be on the same physical or logical network segment. Think of a Wi-Fi network in a coffee shop. The attacker is not on the internet at large, but they are close enough to sniff packets or exploit local broadcast protocols. This vector is rare for web apps but common in industrial control systems or Bluetooth devices.
Local means the attacker must have user-level access to the system. They have logged in, perhaps via a legitimate account or a previous exploit. They cannot exploit the vulnerability from outside the machine. This often relates to privilege escalation, where a regular user gains admin rights.
Physical means the attacker must be physically present at the location of the vulnerable component. They need to touch the device. This might involve plugging in a malicious USB drive or accessing a maintenance port. While the attack surface is small, the impact can be severe if hardware keys are exposed.
Common Points of Confusion
Teams often confuse the attack vector with the attack complexity. Vector is about distance. Complexity is about how hard the exploit is to execute. A network vector with high complexity is still easier to reach than a local vector with low complexity. Do not mix these metrics.
Another confusion arises with adjacent vectors. Many assume this means "local network". It actually means the same broadcast domain. If your office has multiple subnets separated by firewalls, an attacker on one subnet is not adjacent to a server on another. They are still network-bound, not adjacent.
| Term | Plain meaning |
|---|---|
| Network | Attacker can reach the target from the public internet. |
| Adjacent | Attacker must be on the same local network segment. |
| Local | Attacker must have a valid user account on the system. |
| Physical | Attacker must touch the hardware or be in the same room. |
| Vector | The method or path an attacker uses to reach the target. |
| Scope | Whether the vulnerability affects only the vulnerable component or other components too. |
Why Distance Dictates Priority
When you triage vulnerabilities, the attack vector is the first filter. A network vulnerability is always more urgent than a local one, all else being equal. Why? Because the attacker pool is global. A local vulnerability only affects those who already have access. If your system has no remote users, a local privilege escalation is a lower priority.
This logic applies even if the local vulnerability has a higher impact score. A remote code execution with low impact is often more dangerous than a local denial of service. The remote attacker can exploit it millions of times. The local attacker can only exploit it once per compromised account.
The Hidden Cost of Misclassification
Imagine you classify a network vulnerability as local. You delay the patch, assuming only insiders are at risk. Meanwhile, an automated scanner finds it and exploits it from the internet. Your assumption was wrong because the vulnerability was bound to a public-facing port. Misclassifying the vector leads to false security. It creates a blind spot where you believe you are safe, but you are not.
This error often happens with internal tools. If an internal web app is exposed to the corporate network, it is still a network vector. It is not local just because it is "internal". The corporate network is a network. The attacker can be any infected laptop on that network.
Try This Now
- Pick a recent vulnerability report. Identify the attack vector. Ask yourself: can an outsider reach this port? If yes, it is network. If no, check if it requires login.
- Review your public-facing services. Map them to the four vectors. You will likely find most are network. This confirms your exposure is broad.
- Check your internal tools. If they are accessible via HTTP on the corporate LAN, label them network, not local. This ensures you patch them with appropriate urgency.
Related Concepts
Understanding vectors helps you contextualise other risks. For instance, command injection flaws are often network vectors if they exist in a web parameter. NoSQL injection works similarly, depending on where the input is processed. If you are managing dependencies, a software bill of materials (SBOM) helps you track which components might have these network-exposed flaws.
When dealing with session management, session fixation is a local or network attack depending on how the session ID is transmitted. If it is in a cookie sent over HTTPS, it is network. If it requires physical access to the browser, it is physical. Always check the vulnerability severity ratings to see how the vector influences the final score.
The Limits of the Metric
The attack vector is only one part of the score. It does not tell you if the vulnerability is exploitable. It only tells you how close the attacker must be. A network vector with impossible complexity is still low risk. A physical vector with trivial complexity might be high risk for a server room.
You must combine vector with complexity, privileges required, and user interaction. The vector sets the stage. The other metrics tell you if the play can happen. Do not rely on the vector alone. Use it as the first step in a deeper analysis.
Key takeaways
- Network vectors carry the highest base score because they require no physical or network proximity.
- Adjacent vectors reflect attacks from the same broadcast domain, such as a compromised neighbour on a Wi-Fi network.
- Local vectors require the attacker to already have user-level access to the system before exploitation.
- Physical vectors represent the lowest remote risk but imply total loss of hardware control.
The attack vector defines the attacker's starting position, not the final impact. Always verify if a service is exposed to the internet before labelling it local or adjacent.
Frequently asked questions
Is an API endpoint always a network vector?
Yes, if the API is accessible via standard network protocols from outside the immediate broadcast domain.
Can a vulnerability have multiple attack vectors?
No, CVSS assigns one primary vector based on the easiest path an attacker can take.
How does this relate to open redirect vulnerabilities?
Open redirects are often network vectors if the URL parameter is publicly accessible, allowing remote attackers to initiate the redirect.
Does web cache poisoning change the attack vector?
No, the vector remains network if the cache is accessible via HTTP. The poisoning mechanism is the exploit, not the access path.
How this guide was produced: written by the AppSec Scoop editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
